# Wetech Dedicated Drive9 Browser State

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "wetech-dedicated-drive9-state-2026-09-01",
  "problems": [
    {
      "problemId": "wetech-browser-state-cannot-refresh-across-tool-runs",
      "summary": "The Wetech Managed Tool receives one immutable browser storage-state snapshot through Organization Auth, so a refreshed P81, Grafana, or Dashboard session cannot be reused by later isolated Tool runs and repeated login risks provider rate limiting.",
      "status": "optimized_verified",
      "applicability": "Agent9-backed Wetech OP evidence acquisition across isolated Managed Tool executions that use the same authorized Wetech identity.",
      "issueKeys": ["APID-29340"],
      "sourceRefs": ["manual:wetech-auth-state#problem:wetech-browser-state-cannot-refresh-across-tool-runs"],
      "signalTextIncludesAny": [
        "wetech storage state",
        "frequent perimeter81 login",
        "browser state cannot refresh"
      ],
      "observedThrough": "2026-09-01",
      "effectiveAt": "2026-09-01T14:46:14Z",
      "verifiedAt": "2026-09-01T14:53:06Z",
      "attemptedAction": "Give the Wetech Managed Tool one dedicated Drive9 workspace, read its latest Playwright storage state before every browser run, and write refreshed state back with revision CAS without mounting an Agent Session Drive.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/APID-29340"
    }
  ]
}
-->

- Owner: Wetech Managed Tool package and installation Auth
- Source: Wetech authentication-state operational review
- Implementation status: deployed as Wetech Managed Tool v8
- Effective status: `optimized_verified`

## Bounded problem

Managed Tool executions use fresh isolated browser sandboxes. The previous
package injected one Base64 Playwright storage-state snapshot through
Organization Auth, but Organization Auth is not a high-frequency mutable state
store. A refreshed P81, Grafana, or Dashboard session therefore could not
become the next invocation's starting state.

## Intended change

Provision one Drive9 workspace used only by the Wetech Managed Tool. Bind its
owner key through the existing Wetech installation Auth, read the bounded
`/wetech/auth/storage-state.json` file before browser startup, and write changed
state back against the observed revision. Keep the Agent Session Drive,
Provider result, Tool arguments, prompts, and package source free of browser
credential state.

## Verification

- Published and read back all 66 version-pinned package objects plus bundle
  `1261ae80022e92b1d1863c9607e98f946cc0b73bc700f4e01b5242fb2c7ad8e2`.
- Agent9 loaded the bundle with init exit 0 and remained on the unchanged image;
  `/livez` and `/readyz` returned HTTP 200.
- Both Wetech installations read back at v8 with the replacement Auth binding.
- Agent9 session `sess_6639fa71f28f4e1b912947df82fac759` ran exactly two
  serial Managed Tool operations for APID-29340 and SaaS01: a five-minute
  Grafana range query and a Dashboard Slow Query with `limit=1`. Both Tool
  Operations succeeded.
- The dedicated state file metadata changed from revision 1 and 27 bytes to
  revision 2 and 1752 bytes. No state bytes or credential values were read back
  into evidence.

The enclosing Agent9 Turn failed after both successful Tool Operations because
the final LLM completion returned `unknown_result`; that later response failure
does not weaken the verified Tool transport result.

## Unresolved gaps

- The dedicated Drive9 owner key grants the Tool access to that complete
  workspace, so the workspace must contain only Wetech authentication state.

## Next validation action

On a later ordinary Wetech evidence run, confirm that the Tool starts from
revision 2 or newer and only advances the revision when Playwright state
actually changes.